Default application of json codec and ECS

[TheVastyDeep]

For Content-Type application/json the json codec is used by default. That is helpful, but with the introduction of ECS it creates an issue. If the target option on the codec is not set (and the plugin does not set it) then logstash logs an INFO message about ECS compatibility is enabled but target option was not specified. This can be worked around using

additional_codecs => {}
codec => json { target => "[document]" }

but that is not very obvious, and it is not specific to the Content-Type. Perhaps the documentation should address this.

[Eliav2]

absolutely! took me few hours just to understand how to place the http body fields into the target field. (codec => json { target => "[document]" } is not working unless you specify additional_codecs => {})

[chrisred]

Plus one on this. I also wasted a couple of hours trying to work out why the target option was not being applied. I found https://discuss.elastic.co/t/json-codec-plugin-target-option-http-input/304217 in the end to point me in the right direction.

I also tried setting

additional_codecs => {
  "application/json" => json {
    target => "[document]"
  }
}

to configure the behaviour for application/json but I got an error, so assume this is not possible? In which case I'm not sure what the benefit of giving additional_codecs a default value even is?

I expect changing the default behaviour now is unlikely to happen. But the need to set additional_codecs => {} should be clearly noted in the documentation at least.

As @TheVastyDeep says, this also is the cause of an unexpected "ECS compatibility" message.